Robert Leonard Information Security Manager Hamilton IT Annual Training-2016 Information Security – Creating Awareness, Educating Staff, and Protecting Information Robert Leonard Information Security Manager Hamilton

Understanding Threats What is valuable? Trade Secrets CPNI Personal Identifiable Data What is vulnerable? Desk Work Area What can we do to safeguard and mitigate threats? What can we do to prepare ourselves? Education Annual Testing Most believe they will win lottery before getting hit by malicious code

Keep Sensitive Data Private Protecting Information like: CPNI Drivers license number Insurance numbers Passwords and PIN’s Banking information Trade Secrets

Passwords Select a good one Keep passwords safe Change them often At least 7 characters Mixture of upper and lowercase characters Mixture of alpha and numeric characters Do not use dictionary words Keep passwords safe Change them often Don’t share or reuse passwords

Email & Chat Services Email and chat are sent in clear text over the Internet Data can easily be captured and read by savvy computer users and systems administrators Do not use these programs for sending/receiving sensitive information Thought---What are some other possible ways we can accomplish this??

Enhance Our Work Area Security Secure workstations Lock our systems (Windows+L) Shut down Double check our virus scanning software is up to date Password protect files Apply software patches What else can we do to secure the work area??

Incident Response Do you know what to do and who to contact if a security breach occurs? Report immediately to your Business Line Manager or Information Security Manager (Rob Leonard) Write down all pertinent information about the breach so you don’t forget details.

What is Social Engineering? Social engineering is the psychological manipulation of people for the purpose of gathering information, fraud, or system access.

5 Types of Social Engineering Pretexting Phishing Baiting Quid Pro Quo Tailgating

Pretexting Creating an invented scenario to manipulate a person to divulge information or perform an action. Example – You get a call from someone claiming to be from your bank. They say that there has been some suspicious purchases from your account. To correct the problem they ask for your account information. The attacker then use this information to access your bank account.

Phishing Attempting to acquire sensitive information by masquerading as a trustworthy source in an email. Example – Attacker send you an email stating your PayPal account has had to many failed logons and requires you to change your password. A link in the email leads to a web page that looks like it is the PayPal webpage. Once you enter your logon information they now have your username and password to access your account.

Quid pro quo A hacker offers a service or benefit in exchange for information or access. Example – Attacker pretends to be from an IT service and offers assistance to each victim. They promise a quick fix if the person would disable their Anti-Virus program. They then install a piece of malware on the computer that assumes the appearance of software updates.

Baiting An attacker leaves a malware-infected physical device, such as a USB flash drive in a place it is sure to be found. Example - A flash drive may be placed on the ground labeled 2016 Financials. A user then picks up the disk and plugs it into there computer. Malware on the computer then infects it.

Tailgating Someone who lacks the proper authentication following an employee into a restricted area. Example – A person posing as a delivery driver asks for an employee to hold the door, thereby gaining access to the facility.

How to Prevent Social Engineering Attacks Never provide confidential information or credentials to unknown sources. If you receive an email with a link to an unknown site, avoid the instinct to click it. If you are unsure if an email is legitimate, try contacting the company directly or contact your IT staff. Always be wary of USB drives and disks you find lying around. Don’t hold a door open for someone in a secure building. Always require them to use the hand scanners for access.

Thank You!!! If you have any questions, feel free to contact your Business Line Manager or Hamilton's Information Security Manager (ISM) at Ext. 7223. REMEMBER to take the test on the Intranet site to satisfy your responsibility to have Annual Security Training.